After disabling anonymous access in the permission manager in the control panel, ASP.net pages are still accessible without getting prompted with authentication. 

In order to force ASP.net to take NTFS permission into consideration, the authentication mode in the web.config file must be set to Windows.